chore: pre-release maintenance pass (2026-04-14)

[chaliy]

Summary

• Update command counts from 156 to 160 across all docs (README, lib.rs, Python/JS READMEs, specs) to reflect ssh/scp/sftp, jq feature-gated builtins, and exec
• Move jq from core to feature-gated list in spec 009; add ssh/scp/sftp and exec
• Fix rustdoc broken links to feature-gated modules (python_guide, logging_guide, HttpClient)
• Update deny.toml: remove stale RUSTSEC-2023-0071, add RUSTSEC-2026-0097
• Add missing Status header to spec 017 (request-signing)
• Simplify DiscoverBuiltin::filter_tools() — remove unused json_mode return value and unreachable --categories branch

What changed

Documentation drift fixes: The actual builtin count is 148 core + 12 feature-gated = 160 total. Docs referenced 150 or 156 in various places due to additions of ssh/scp/sftp (ssh feature), jq (jq feature), and exec (interpreter-level) that were never reflected in docs.

Rustdoc fixes: Three broken doc links — python_guide and logging_guide are behind feature gates so [link] syntax fails without the feature; HttpClient requires http_client feature.

Advisory cleanup: RUSTSEC-2023-0071 (rsa Marvin attack) no longer matches any crate in the dependency tree. Added RUSTSEC-2026-0097 (rand unsoundness with custom loggers) — transitive, no impact on bashkit.

Code simplification: DiscoverBuiltin::filter_tools() returned an unused json_mode bool and had an unreachable --categories early-return (the caller handles categories before calling this function).

Test plan

• cargo test — 2,347 tests pass
• cargo fmt --check — clean
• cargo clippy --all-targets --all-features — clean
• RUSTDOCFLAGS="-D warnings" cargo doc — clean
• cargo deny check — passes
• Scripted tool example runs end-to-end
• All non-feature-gated examples verified